Offline Mode is Binsight's core operational posture. It allows site reliability engineers, security auditors, and database administrators to inspect binary logs without requiring network access or read credentials on production database clusters.
How Offline Mode Works
When you invoke binsight serve /path/to/binlogs:
- Scanner Pass: Binsight traverses the target directory and parses binlog file headers (verifying the magic 4-byte binlog header
0xfe 0x62 0x69 0x6e). - Index Creation: It creates a lightweight SQLite index file located at
~/.binsight/index.db(or the path set viaBINSIGHT_DATA_DIR). - Zero-Copy Header Cache: Only event metadata (file offset, end position, timestamp, server ID, event kind, and table ID) are indexed into SQLite. Large row payloads, before/after images, and raw SQL queries are read lazily from disk on demand when you click a specific event.
- File Watching: If new binlog files are written or rotated into the directory, Binsight's background
fsnotifywatcher detects changes and updates the event timeline automatically.
Binlog Discovery & Naming
Binsight recognizes common MySQL and MariaDB binlog naming patterns out of the box:
mysql-bin.[0-9]+(e.g.mysql-bin.000142)binlog.[0-9]+(MySQL 8.0 default)mariadb-bin.[0-9]+- Gzipped archives if pre-extracted to disk
Zero-Config SQLite Index
The index lives in your user home directory and requires zero configuration. To wipe the cache and force a complete re-index of a directory:
Terminal
binsight serve --clean-index /var/lib/mysql
Air-Gapped Compliance
In high-compliance or forensic scenarios (SOC2, PCI-DSS, HIPAA, or air-gapped defense networks):
- Binsight opens binlog files with
O_RDONLYpermissions. - Binsight makes zero outbound telemetry or analytics calls.
- The web UI assets (HTML, CSS, JS, fonts) are embedded directly into the Go binary at compile time—no CDN requests are performed during execution.